The data controller is committed to complying with current regulations regarding the protection of personal data. This Privacy Policy informs users about the processing of their personal data so that they can freely and voluntarily decide whether to provide the requested data.
The processing of users' personal data will be carried out in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data —GDPR—, as well as Organic Law 3/2018, on the Protection of Personal Data and Guarantee of Digital Rights —LOPDGDD—.
Information about the responsible treatment
- Responsible for treatment: Half Full Venture, SL
- Tax ID: B-86601697
- Adress: Imperial Street, number 9, 28012 Madrid
- Email: lopd@thehatmadrid.com
- Phone: +34 917 728 572
Changes to the Privacy Policy
The CONTROLLER reserves the right to modify this Privacy Policy in order to adapt it to new legislation, case law or changes in the processing of personal data.
Any changes made will be published on the website, so users are advised to periodically consult this Privacy Policy to stay informed about the processing of their personal data.
Purposes and legitimacy of the processing
The processing of the user's personal data may be necessary for compliance with the legal obligations of the data controller.
In those cases where the processing is based on the user's consent, this will be expressly requested at the time of data collection.
The personal data provided by users will be processed by THE CONTROLLER for the following purposes:
- To handle requests for information, inquiries or communications made by users through the contact details and, where applicable, through the contact form available on the website. Legitimation of the treatment: user consent.
- Manage online accommodation bookings carried out by users through the forms enabled for this purpose, as well as the communications necessary for their management, confirmation or modification. Legitimation of the treatment: consent of the interested party and, where appropriate, execution of pre-contractual measures requested by the user.
- Manage the administrative relationship with users, including the management of collections and billing for the proper provision of services. Legitimation of the treatment: execution of the contractual relationship and compliance with legal obligations.
- Manage and comply with legal obligations that are applicable to the data controller. Legitimation of the treatment: compliance with a legal obligation.
- Sending informational or commercial communications related to the services offered by THE CONTROLLER, by electronic or non-electronic means, such as email, telephone or instant messaging systems, provided that the user has previously given their consent. Legitimation of the treatment: consent of the interested party.
When data processing activities require user consent, such consent will be requested at the time of data collection.
Cookie policy
This website uses cookies. For more information, please see the Cookie Policy available on the website.
Recipients of the data
The CONTROLLER does not transfer personal data beyond what is explicitly regulated in current Spanish legislation, nor does it carry out international data transfers.
Personal data may be communicated to third parties only when there is a legal obligation or when it is necessary for the proper provision of the services requested by the user, under the terms provided by the applicable regulations.
Data retention
The personal data provided by users will be kept for the time necessary to respond to information requests, manage reservations, maintain the administrative relationship and provide the requested services.
Once these purposes have been fulfilled, the data will be deleted, without prejudice to its retention for the legally required periods for compliance with applicable legal obligations.
Veracity of the data
The user will be responsible for the accuracy of the data provided, as well as for any personal data of third parties that they may provide.
Likewise, the user must inform the data controller of any modification, rectification or cancellation of said data, in order to keep them up to date.
Confidentiality and secrecy
The CONTROLLER undertakes to comply with its obligation of secrecy and confidentiality with respect to the personal data processed.
It also undertakes to adopt the necessary measures to guarantee its confidential treatment, in accordance with current data protection regulations.
Origin of the data
The personal data processed by THE CONTROLLER comes from the data subject himself.
In the event that personal data is provided by a third party, the CONTROLLER will inform the interested party of this circumstance, in accordance with the provisions of Article 14 of Regulation (EU) 2016/679, General Data Protection Regulation —GDPR—.
Rights of the interested party
The user may exercise the following rights at any time:
- Right of access: It allows you to know what personal data of the user is being processed by THE CONTROLLER.
- Right of rectification: It allows you to modify personal data that is inaccurate or incorrect.
- Right of withdrawal: It allows you to request the deletion of personal data when, among other reasons, it is no longer necessary for the purposes for which it was collected.
- Right to restriction of processing: It allows you to request the limitation of the use of personal data, in which case it will only be kept for the exercise or defense of claims.
- Right of opposition: It allows you to object to the processing of personal data in certain cases.
- Portability right: It allows obtaining personal data in a structured, commonly used and machine-readable format, as well as transmitting it to another controller when technically possible.
Those interested may exercise their rights of access, rectification, erasure, limitation of processing, opposition and portability of their personal data, as well as revoke the consent given, by sending a request to the data controller via email to lopd@thehatmadrid.com , indicating in the subject the right they wish to exercise.
When necessary to verify the identity of the applicant, additional information may be requested in order to respond to requests to exercise rights in accordance with the provisions of current data protection regulations.
Those interested may also contact the Data Protection Officer for any questions related to the processing of their personal data via the email address lopd@thehatmadrid.com.
Notwithstanding the foregoing, the interested party may lodge a complaint with the Spanish Data Protection Agency — www.aepd.es — or with the competent supervisory authority, if he considers that the processing of his personal data does not comply with current regulations.
Last updated: May 6, 2026.
